WordPress Adventure Bucket List Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Adventure Bucket List Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51908 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5a843ca67ed0 Credits SOPROBRO Required privilege...

WordPress SV Forms Plugin <= 2.0.05 is vulnerable to Cross Site Scripting (XSS)

Software SV Forms Type Plugin Vulnerable versions = 2.0.05 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51877 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7bf14e1f9476 Credits Joshua Chan Required privilege Contributor...

WordPress Custom URL Shortener Plugin <= 0.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Custom URL Shortener Type Plugin Vulnerable versions = 0.3.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51930 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 721373a7389e Credits SOPROBRO Required privilege...

WordPress Wd-image-magnifier-xoss Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Wd-image-magnifier-xoss Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51840 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c2adb78229c9 Credits SOPROBRO Required privilege...

WordPress Text Advertisements Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software Text Advertisements Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51879 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c4a6f56c833e Credits SOPROBRO Required privilege Contributo...

WordPress Creative Blocks Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Creative Blocks Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51822 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 92ca1e6db3e1 Credits Gab Required privilege Contributor...

WordPress Banner System Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Banner System Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51816 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ea8cc644eeb0 Credits ghsinfosec Required privilege Contributor...

WordPress Luzuk Testimonials Plugin <= 0.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Luzuk Testimonials Type Plugin Vulnerable versions = 0.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51872 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e42d6eaf9f4a Credits SOPROBRO Required privilege Contribut...

WordPress Bitcoin Payments Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Bitcoin Payments Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51826 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a52098c8793 Credits SOPROBRO Required privilege Contributor...

WordPress Shortcode Collection Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Shortcode Collection Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51864 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a79b02ce6496 Credits SOPROBRO Required privilege Contribut...

WordPress Brand my Footer Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Brand my Footer Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51801 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2b661efe3aa8 Credits SOPROBRO Required privilege Contributor...

WordPress Awesome Fitness Testimonials Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Awesome Fitness Testimonials Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51806 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6dc5acf46761 Credits SOPROBRO Required privilege...

PT-2024-16443 · WordPress · Content Slider Block

Name of the Vulnerable Software and Affected Versions: Content Slider Block plugin for WordPress versions prior to 3.1.6 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password protected, private, or draft posts via the csb...

PT-2024-16102 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce versions up to, and including, 2.7.4 Description: The myCred plugin is vulnerable to Stored Cross-Site Scripting via the plugin's mycred link shortcode due to insufficie...

WordPress Envo Extra Plugin <= 1.9.3 is vulnerable to Sensitive Data Exposure

Software Envo Extra Type Plugin Vulnerable versions = 1.9.3 Fixed in 1.9.4 OWASP Top 10 A3: Injection Classification Sensitive Data Exposure CVE CVE-2024-10770 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c74e911b1aae Credits Francesco Carlucci Required privilege...

PT-2024-16445 · WordPress · Countdown Timer Block Plugin

Name of the Vulnerable Software and Affected Versions: Countdown Timer block plugin for WordPress versions up to, and including, 1.2.4 Description: The Countdown Timer block plugin for WordPress has an Information Exposure issue due to insufficient restrictions on which posts can be included via...

WordPress Multi-day Booking Calendar Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Multi-day Booking Calendar Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51873 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1e4344dc5b6c Credits SOPROBRO Required privilege...

WordPress myCred plugin <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin myCred versions = 2.7.4...

WordPress Simple Shortcode for Google Maps plugin <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Akbar Kustirama in WordPress Plugin Simple Shortcode for Google Maps versions = 1.5.4...

CVE-2024-8442

The Prime Slider – Addons For Elementor Revolution of a slider, Hero Slider, Ecommerce Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on...